TrustBOM: A Scalable Architecture for Confidentiality-Preserving SBOMs Across Organizations
TrustBOM lets vendors prove SBOMs lack specified vulnerabilities or licenses without revealing dependencies.
TrustBOM is a CI/CD architecture for confidentiality-preserving software bills of materials. Providers use zero-knowledge non-membership proofs to attest that specified vulnerabilities or restricted licenses are absent without revealing the dependency graph. Proof generation scales with the number of policy constraints rather than SBOM size, averaging 0.9 seconds per constraint on commodity hardware.
- Zero-knowledge proofs hide dependency graphs while attesting policy compliance.
- Proof cost scales linearly with the number of constraints.
- Average generation time is 0.9 seconds per constraint.
- Designed to integrate with enterprise CI/CD workflows.
From the original article
1 min read at arxiv.orgSoftware Bills of Materials (SBOMs) have emerged as a key mechanism for software supply chain governance in enterprise architectures. However, their adoption across organizations remains limited due to concerns about exposing sensitive dependency information. To address this limitation, we propose TrustBOM, a scalable architecture for confidentiality-preserving SBOMs integrated into enterprise CI/CD workflows.
By Van Thang Nguyen · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.